The unlicensed mobile access (UMA) specifications recommend that the unlicensed network controller (UNC) and the unlicensed network controller secure gateway (UNC-SGW) should check that the same International Mobile Subscriber Identity (IMSI) is used when a mobile station (MS) establishes the IPsec secure connection towards the UNC-SGW and when the MS registers at the UNC. In both these instances, the MS provides the IMSI to the UNC-SGW and UNC, respectively. The UMA specifications do not, however, define how these checks should be made. Yet, the implementation of these recommendations still leaves the core network open to attacks.
This is also the case in the 3d Generation Partnership Project (3GPP) standards for “Generic Access to A and Gb-interface”, otherwise known as a Generic Access Network (GAN). See 3GPP Technical Specifications 43.318 (Stage-2) and 44.318 (Stage 3). Note that the generic access network controller (GANC) in the 3GPP specifications is equivalent to the UNC in the UMA specifications. Similarly, the generic access network controller secure gateway (GANC-SEGW) in the 3GPP specifications is equivalent to the UNC-SGW in the UMA specifications.
For example, a MS could use multiple Temporary Mobile Subscriber Identities (TMSI) or Packet Temporary Mobile Subscriber Identities (P-TMSI) to emulate multiple MSs, such as a personal computer (PC) with a SIM-card reader and a UMA client. Moreover, a hostile MS could send Location Updates or IMSI Detach messages towards the core network causing a type of denial-of-service (DoS) attack on the MS-level (terminating calls would fail, etc.). Accordingly, there is a need for a method and apparatus that protects the core network by checking the mobile identities (IMSI, TMSI and/or P-TMSI) used by mobile stations when they communicate with the core network.